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The model of the quantum protocols sealing a classical bit is studied. It is shown that there 
exist upper bounds on its security. For any protocol where the bit can be read correctly with the 
probability a, and reading the bit can be detected with the probability 0, the upper bounds are 
< 1/2 and a + sC 9/8. 
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I. INTRODUCTION 

Data sealing is a cryptographic problem between two 
parties. A sender (Alice) stores some secret data in a 
certain form, so that any other reader (Bob) can read 
it without Alice's helping. Meanwhile, if the data has 
been read, it should be detectable by Alice [2 . A com- 
mon example of classical data sealing is closing a letter 
in an envelop with a wafer of molten wax, into which was 
pressed the distinctive seal of the sender. 

Like all other classical cryptographic protocols, it is in- 
teresting to find the quantum version of data sealing for 
better security. Bechmann-Pasquinucci first proposed 
a protocol which seals a classical bit with a three-qubit 
state. Singh and Srikanth[3j extended the idea into a 
many-qubit majority voting scheme, and associated it 
with secret sharing to improve the security. ChauQ pre- 
sented a protocol which seals quantum data with quan- 
tum error correcting code. The protocol for sealing a 
classical string was also proposedjfj- 

However, as pointed out by the author himself, the 
protocol in Ref. [2j is insecure against collective measure- 
ments. More general, it was further proven 6] that perfect 
quantum sealing of a classical bit is impossible in princi- 
ple. If a protocol allows the bit to be perfectly retrievable 
by the reader, then collective measurements exist which 
can read the bit without disturbing the corresponding 
quantum state. It means that Bob can always read the 
bit without being detected by Alice. In fact, the proto- 
col for sealing quantum data cannot be used for sealing 
a classical bit either. This is because the quantum states 
used for encoding the bits and 1 respectively are or- 
thogonal to each other. They can be distinguished by 
collective measurements without any disturbance too. 

Therefore, it is natural to ask whether imperfect quan- 
tum sealing of a classical bit is possible. Here "imperfect" 
means that the sealed bit b is not perfectly retrievable in 
the protocol. Bob can only read b correctly with the 
probability a < 1, while reading b can be detected with 
the probability (3. Obviously a protocol with a = 1 is a 
perfect one. But if there exists a protocol in which both 
a and (3 are less than but very close to 1, it is still very 
valuable for practical usage. 

Nevertheless, in this paper it will be shown that upper 
bounds exist for a and (3. If Bob uses collective measure- 



ments instead of the honest operations to read b, then the 
upper bounds are (3^1/2 and a + (3 ^ 9/8. This result 
actually bounds the power of practical quantum sealing 
of a classical bit. In the next section we will establish 
a general model of imperfect quantum sealing protocols. 
Basing on the model, the upper bounds will be obtained 
in Section III. In Section IV some examples of imperfect 
protocols are studied. The impacts of the result will be 
discussed in the last section. 



II. THE MODEL 

First let us establish the model of imperfect quantum 
sealing protocols, on which the discussion in this paper 
is based. Note that here and in the following content, 
when speaking of quantum scaling protocols, we means 
the protocols for sealing a classical bit only, except where 
noted. The details of the data sealing process is not im- 
portant to our discussion, but the ending of the protocol 
generally has the following features: 

(1) Bob knows an operation P; 

(2) Bob owns a quantum system \I/ ('5 may not be in 
the eigenstate of P. Otherwise the protocol becomes a 
perfect one); 

(3) Alice lets Bob know two sets G , G x (G nGi = 0), 
such that if he applies Ponf and the outcome is g € Go 
(g G Gi), he should take the value of the sealed bit as 
b' = (&' = 1); while if g ^ GoUGi, the sealed bit cannot 
be identified, i.e. Bob needs to guess b' randomly by 
himself. Note that since 1 F may not be in the eigenstate 
of P, the value of b' thus obtained will match Alice's 
input b with a probability a only; 

(4) Alice owns a quantum system $ entangled with , F. 
And she knows that the initial state of the system <E> ^> 
is \4> <S> yj); 

(5) At any time Alice can access to the entire system 
$£g> ^ and compare its state \4>' ® ip') with \<p (g) tp). Thus 
she can detect whether b has been read with the proba- 
bility = 1 - V>l 4>' ®V)\ 2 - 

Note that in the protocols previously proposed (e.g. 
Refs. 0,111), Alice does not own the system $ described 
above, and the case g ^ Go U Gi generally will not occur. 
But to make our result as general as possible so that it 
may cover other protocols potentially existed, we include 
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these features in the model. Obviously previous protocols 
are only the special cases of the model where the entan- 
glement between $ and ^ has already collapsed before 
the end of the protocol, and Go, G\ cover all possible 
outcomes of g. 



III. THE UPPER BOUNDS 

Let H be the global Hilbert space constructed by all 
possible states of $ . {|e.j)} denotes a basis of H, which 
is the eigenvector set of the operation P. It can be di- 



vided into three orthogonal subsets { ef^ )}, { 



M 2) )}, such that V|V>) e { £j 0) )} (V|</>) € { 



} and 

applying P on \ip) will lead to b' = (b' = 1); and 

} will lead to b' = and 6' = 1 with the 

equal probability 1/2. is consequently divided into 
three subspaces Hq, Hi and H2, whose eigenvector sets 



V 



are { e-°^H, { e\ L> j} and { e-^} respectively. 

Though the subspaces H , Hi and H 2 are orthogonal 
to each other, the quantum states used for encoding the 
bits and 1 respectively need not to be orthogonal in an 
imperfect quantum sealing protocol. Instead, any state in 
H could be the state of the system ^. That is, the state 
of ^> may contain the vectors from different subspaces, so 
that the states used for encoding and 1 may overlap. In 
this case, the cheating strategy in the impossibility proof 
of perfect quantum sealing can not be successful with the 
probability 1. 



■,(2) 



However, note that { 



;«>) 



>},{ 
Let 



} and {ef } )} 



form a complete basis of H. 
denotes the initial state of $ (g> \1/ when Alice want to seal 
b = (b = 1). It can always be expanded as 



k ® tpt) = 




(1) 



with a 



(0)^(1) 



(2) 



i,£A (0) 



b.i 



EA (2) 



b.i 



(sum over all possible i within each corresponding sub- 
space), b = 0,1. All fij are the vectors describing the 

state of $, which are not required to be orthogonal to 
each other. 

With such initial states, it can be seen that the maxi- 
mal probability for Bob to read b correctly (i.e. his out- 
come b 1 matches Alice's input b) is 



[(a^+a^/2) + (a^+aY'/2)}/2 



,(2) 



(1) 



„( 2 ) 



(2) 



Consider a dishonest Bob who does not use P but 
the following strategy to read b. Define two operators 



p 3 = E 



(sum over all possible i within Hj 



j = 0, 1), which are the collective measurements project- 
ing the quantum state into the subspaces Hq and Hi 
respectively. Bob randomly chooses to apply either Po 
or Pi on if? with the equal probability 1/2. If his choice 
is Pj and 4" can be projected to the subspace Hj success- 
fully, he takes b' = j; else if the projection fails, he always 
takes b' = j without further measurements on the quan- 
tum state. That is, he never makes further attempts to 
distinguish the state between the two subspaces Hj and 
H2 ■ It can be shown that with this strategy, Bob can also 
reach the maximized a in Eq.J2J. Now let us calculate 
the probability (3 for the reading to be detected by Alice. 
There can be four different cases: 

(1) Bob's choice is Po, and the initial state of $ (g> ^f? 
is |0 <8> tp) = |0o ® ipo)- From Eq.Q it can be seen that 
if? can be projected into Ho successfully with the proba- 
Meanwhile, $ ® if? collapses to \(j>' ® tp') = 



bility ckq . 



(0) 



;(0) 



It can be viewed as the initial 



state with the probability po s 



„(°) 



I (0® "01 0'<g>'0 / ) 



Therefore Alice can detect the disturbance of the 



state with the probability 



j3os = 1 - Pos = 1 - a 



(0) 



(3) 



On the other hand, the projection can also fail 



with the probability o<q 
lapsing to |0' ®tp') = ( 



(2) 




with $ (g) ^ col- 



li) 



It can be 



viewed as the initial state with the probability pof = 



,.(D 



a, 



(2) 



Therefore Alice can detect the disturbance 



with the probability 
Pot = 1 - 



Pot 



1 



„(1) 



>.(2) 



(4) 



Altogether, in this case reading b can be detected by 
Alice with the probability 



2a 0) (l- ai 



Here the condition + alC' + ot)? 1 = 1 is used 



(Oh 



(5) 



(2) Bob's choice is Po, and the initial state of £§> if? 
is |0 ®ip) — |0i(g -0i). Similar to the analysis above, 
in this case reading b can be detected by Alice with the 
probability 



/3i = 2al 0) (l 



a 



(0) 



(6) 



(3) Bob's choice is Pi, and the initial state is \(p <S> ip) — 
|0o <8> ipo)- Similar to Eq.JSJ), the detecting probability is 



/3 = 2a 1) (l-«o ij ) 



(ih 



(7) 
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(4) Bob's choice is P\, and the initial state is\<j) ® ip) = 
bx ®ipi). Similar to Eq.|@, the detecting probability is 



0[ = 2a { l\\-a\ L L> ) 



(l)^ 



(8) 



In all, the average probability for Alice to detect the 
reading is 

= [offl-afj+affl-af) 

+4 1) (l-4 1) ) + ai 1) (l-a 1 1) )]/2. (9) 

The right-hand side of this equation reaches its maximum 



o 



J 1 ) - J 1 ) 



a\ = 1/2 and ccq 



(2) _ ..(2) 



O'n 



when a, 

0. Thus the upper bound for [3 is 

13 < 1/2. (10) 
Combining Eqs.© and ©, we have 

a + (3 = [4 0) (3/2 - a ^)+a^ (1/2 - ag>) 

+a«(3/2-a«) + a^(l/2-4 0) ) 
+l]/2. (11) 

The right-hand side of this equation reaches its maximum 
when Q!q ' > = = 3/4, = = 1/4 and — 

(2) 

a Q = 0. Thus we obtain another upper bound 

a + /3sC9/8. (12) 



IV. EXAMPLES 
A. Breaking the majority voting scheme 

Here we give an example on how the above cheating 
strategy is applied to an embodied protocol. 

In Ref.0 a compound scheme was proposed, which 
embeds a majority voting quantum sealing scheme in a 
classical secret sharing scheme. As pointed out by the 
authors, the entire scheme is secure since the secret shar- 
ing scheme prevents any single reader from possessing all 
the qubits to perform collective measurements. Without 
the secret sharing scheme, as it will be shown below, the 
majority voting scheme alone is insecure. 

The majority voting scheme is defined as follows. To 
seal a classical bit 6, Alice prepares n qubits. fn (/ < 
1/2) qubits called the code qubits are prepared in the 
state \b). The other (1 — f)n qubits called the seal qubits 
are put randomly in any eigenstate of the diagonal ba- 
sis |±) = (|0) ± |1))/V2. To read the bit b, an honest 
Bob is supposed to measure each qubit in the computa- 
tional basis {|0) , |1)}. He takes 6 = (or 1) if more than 
n/2 qubits are found as |0) (or |1)). Since / < 1/2, we 
can see that the states encoding and 1 are nonorthog- 
onal to each other. Bob stands a nonzero probability of 
misreading the bit. Therefore it is an imperfect sealing 
scheme. 



The cheating strategy to this scheme is exactly the 
one described in the previous section. Let w(c) denote 
the weight (the number of the bit 1) of a classical binary 
n-bit string c. The eigenvector set { | } } in the present 
case is the computational basis {|c)} of the global Hilbcrt 
space H, where c runs through all possible classical 71- 
bit strings. Its three orthogonal subsets are defined as 

{|ef )} = {\c)\w(c) < n/2}, {|e«)} = {\c)\w(c) > 

n/2} and { ef'A} = {\c) \w(c) = n/2}. The three sub- 
spaces H , Hi and H 2 are consequently defined by these 
subsets. 

For simplicity let us consider the case where n is odd 

so that { e\ 2 ^} = 0. Let be the state of the n-qubit 

system encoding b. For any |^&) with fn code qubits, 
we can expand all the (1 — f)n seal qubits in the compu- 
tational basis. Thus \ipb) is expanded into N = 2^~^ n 

items, of which M® = Ylfjn+i)/ 2 ( (1_ / )n ) items be " 

long to { ep\}, while the other M® =N- M® items 



belong to { efA}. That is 



\iM = ^MM/iV^A®/^®) 

i 

+^mW/nJ2(^? } / v 7 ^® ) 

i 

where any can only be ±1 or 0, with ^2 -A-^ = VW, 



(13) 



J2^f = VM®. For example, an n = 5, / = 0.4 state 

i 

|11 H h) sealing b = 1 (the first one in Eq.(l) of Ref. 

|3) can be expanded as 

|11 + -+) = (|11000) 

+ |11001) - |11010) - |11011) 
+ |11100) + |11101) - |11110) 
- |11111))/V8, (14) 

where the first item on the right of the equation belongs 

to { e| ^}, while the other 7 items belong to { e^ 1 ^}. 

Obviously when \ip£) is measured honestly, b can be read 
correctly with the probability 



= M (b) /N = 1— 

i=(n+X)/2 



/2 



(i-/) 



(15) 



On the other hand, a dishonest Bob can always use 
the operator Pq — ^ |c) (c\ (sum over all c satisfying 
w(c) < n/2) to perform a collective measurement on \ipbj- 
He takes 6 = whenever the projection is successful, else 
he takes 6=1. It can be seen that he can also read 6 
correctly with the above probability a. The probability /3 
for the reading to be detected by Alice can be calculated 
by repeating the analysis in the previous section. By 
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- a+p 




FIG. 1: The security of the majority voting scheme, a is 
the probability for Bob to read the bit successfully. (5 is the 
probability for Alice to detect the reading. The solid line 
represents j3 as a function of a. The dashed line represents 
a + (3 as a function of a. 



comparing Eq. (|13fl with Eq.Q, we find = Af (b) /N, 

a[ b) = M®/N and a[ 2) = 0. Substituting them into 
Eq.© gives 



= 



a«(l-aW)+a®(l-a®) 
2a(l - a) 

2 

(i-/) 

• E 

i=(n+l)/2 



f 1 - c e" ( {1 ~ f)n )/^-A 

\ i=(„+i)/2 V 1 / y 



(16) 



Eas. (|15|) and (|16f) clearly show that in the majority 
voting scheme, if Alice wants to rise the readability a, the 
probability (3 for her to detect the reading will inevitably 
drop no matter how she chooses n and /. Especially, 
(3 — > when a — > 1. This result as well as the value 
of a + /3 as a function of a are plotted in Fig.l. Thus 
we see that without being associated with secret sharing, 
the majority voting scheme alone is insecure against the 
collective measurement. 



C. The scheme that reaches the upper bound 

a + (3 = 9/8 

Eq. (IT 1|) indicates that to reach the maximum a + (3 
9/8, Alice should seal the bit b in the form 



\<f>b <8> A) 




(18) 



In this case a = 3/4, (3 = 3/8. Note that keeping the 
system $ (whose state is described by fu) at Alice's side 
is important. Otherwise, consider the simplified version 



\^) = f E 



~(b) 



(19) 



It cannot reach a + f3 = 9/8 if Bob knows that Alice 
has prepared the states this way. This is because the 
cheating strategy in the previous section does not re- 
quire Bob to know the value of a. If he does, he may 
have other optimal strategies to further reduce (3. In the 
present case, Bob can fake the quantum state with a cer- 
tain probability after reading it. For example, if he has 
applied Po on ^> and the projection fails, he knows that 



the state has collapsed to 



Since he knows 



he can use a unitary transformation to shift the state 



into VI - «E Vpo 



,(()) 



(iVois 



the dimensionality of Hq). This generally increases his 
chance to survive through Alice's detection. Therefore 
the value of a + (3 in this protocol will be further re- 
duced. This is also true for the majority voting scheme 
discussed in the section IV. A. If Bob knows / he knows 
a from Ea. (|15|) . so that he can further reduce (3. But if 
there is a system $ at Alice's side, it cannot be faked by 
Bob. Then changing the state at his own side alone will 
be useless and the upperbound could be reached. 



B. The scheme that reaches the upper bound 

= 1/2 

Eq.@ indicates that to reach the maximum (3 = 1/2, 
Alice should seal the bit b in the form 



|</>6 <8> A) 




(17) 



But clearly such a protocol is useless, since the bit can 
only be read correctly with the probability a = 1/2. 
Even random guess based on nothing at all can reach 
such a probability. 



V. DISCUSSION AND CONCLUSION 

The upper bounds 0^1/2 and a + (3 ^ 9/8 found in 
this paper can be seen as an extension of the impossibility 
proof of perfect quantum sealing of a classical bit[||. The 
latter can be seen as the special case where a = 1. Eq.J2J) 



shows that a — 1 means a 

(2) (0) (2) 

*q = a\' = a\' — 



(0) 

o 



(!) 1 A (!) 

a\ = 1 and a 



a' ' = a{ ' = a\ ' =0. Substituting these values into 
Eq.© immediately gives (3 = 0. 

Due to the existence of these upper bounds, quantum 
scaling seems to be far from practical usage, unless we 
can find a protocol that cannot be covered by the model 
proposed in Section II. However, so far there still has 
no sign on the existence of such a protocol. Luckily, as 
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mentioned above, our model is limited to the protocols 
which seal a single classical bit. The protocol which seals 
a classical string 5] is not covered and can be secure. 

Very recently, the insecurity of quantum sealing was 
also studied by Chau 7] , in which a more detailed model 
of quantum sealing ({g ^ GqUGi} = and Bob knows a) 



was analyzed with a different approach. The result (3 ^ 
1/2 was also obtained, which consists with the finding in 
the present paper. 
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